In today’s edition, the long-dormant Reliance Forensics blog starts anew, serving both the legal and forensic communities with regular updates. While working client engagements and conducting trainings in the past year has given us invaluable substantive experience that we can share, it hasn’t left a lot of time for blog writing. Look for more regular updates going forward, and deeper dives into various topics of interest at the intersection of law and digital forensics. Until then:

If you’re looking to access data on a newer iPhone that is locked, the best options are to try to find an iCloud backup (if you have the credentials and proper authorization), or an iTunes backup on a computer into which the iPhone has been plugged (Mac, Windows, doesn’t matter). Many times users have these iTunes backups and don’t even realize it, as they are stored in a location on the computer hidden to the user. They can often be processed for most user data, including some deleted data, just as if we had the original device.

Along those lines, forensic examiner Devon Ackerman recently posted to LinkedIn regarding the forensics possible on various versions of the iPhone by operating system. As this has been very much a moving target, I hope it can be maintained. The current version is linked here.

I recently wrote a piece on ForensicFocus.com discussing the core training curriculum for Cellebrite’s mobile forensic equipment and software. It can be found here. Regardless of the vendor, good mobile forensics equipment is a significant investment. We’ve found the training to be an invaluable resource that allows a far deeper dive into the data than would have been possible otherwise.